h2pc_setup_2[.]1[.]exe

resource
h2pc_setup_2.1.exe
unpack001/$PLUGINSDIR/CRCCheck.dll
unpack001/$PLUGINSDIR/INetC.dll
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/ScrollLicense.dll
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/$PLUGINSDIR/nsis7z.dll
unpack001/uninstall.exe
unpack002/$PLUGINSDIR/InstallOptions.dll
unpack002/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/uninstall.exe	nsis_installer_1
static1/unpack001/uninstall.exe	nsis_installer_2

h2pc_setup_2.1.exe

IMPHASH 3abe302b6d9a1256e6a915429af4ffd2
SHA256 7933a7ae9621dfcf6237c2927da25f5555ef6509560733ffc002fdea902cfcd2
MD5 3bf5a302f9e5c16c94c22cd3214b1c85
SHA1 44412e29a9993e38df4a968b0245750c368c7745
SHA512 4c8a414134b0e9ecc5c9d1bab824e87d83309ac2cbc613007656f72298fa5a209c3d8cbc1e89fc9e16242a6957373f9d03f8ea2d3ebeb6df04ec18696aa2f34c
SSDEEP 12288:Om6sCQYnISqUloS7sSlHvXPsOBMRb5Q+a:6sC/ITUloAl3sJ0J
TLSH
T1D48413227250E897D2E643F058BFAA34F271ED69B16A964B5314BF3FACB302246150D6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12758

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTempPathA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA Sleep GetTickCount GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GetWindowsDirectoryA SetCurrentDirectoryA GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject CompareFileTime SetFileAttributesA GetFileAttributesA GetShortPathNameA MoveFileA GetFullPathNameA SetFileTime SearchPathA CloseHandle lstrcmpiA CreateThread GlobalLock lstrcmpA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GlobalAlloc GlobalFree ExpandEnvironmentStringsA

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyExA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA RegEnumValueA RegDeleteKeyA RegDeleteValueA RegCloseKey RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/CRCCheck.dll

IMPHASH cb5f5e1f6d9c37e2061d9dfe44018cea
SHA256 1755358eb4858fb5540341574dba73a4294eee822e81cc85d25f16c9fe5c66b6
MD5 d08079c2378c4df811a2a24928fbf6bc
SHA1 a70704e255401b693684eb1cf0e585cd33ed0f0d
SHA512 e622ea8f9feafd521bb825e56b367be395f9d63455c581cdb37a82579c2d95da2e4c2d0d95c6c788129148756e61263e7771a168757f06c9850b204e35104a92
SSDEEP 48:ClKMTGQ6uA8F3fYwEZeO9dyMuqclGdpXbX7qNCz:QK9uttMdcMdpXbrj
TLSH
T190914787A3F40899F4B30BFA19F3122796A9FD73567DC65C0965010E2D20961EE30B77
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4418

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/INetC.dll

IMPHASH 8ef3613e48db9e7b48e33704238cd659
SHA256 5520208a33e6409c129b4ea1270771f741d95afe5b048c2a1e6a2cc2ad829934
MD5 92ec4dd8c0ddd8c4305ae1684ab65fb0
SHA1 d850013d582a62e502942f0dd282cc0c29c4310e
SHA512 581351aef694f2489e1a0977ebca55c4d7268ca167127cefb217ed0d2098136c7eb433058469449f75be82b8e5d484c9e7b6cf0b32535063709272d7810ec651
SSDEEP 384:VpOSdCjDyyvBwRlX+ODbswYM2s74NS0v0Ac9khYLMkIX0+Gzyekx:rdCjW/lX1PfYM2X1
TLSH
T123A23B5253605FFEE3D71938B8B7773745EAE76464178A8F06732E8918B2352B930382
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

16209

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

LoadLibraryA LocalFree lstrcpynA DeleteFileA CreateThread WideCharToMultiByte lstrcpyA TerminateThread LocalAlloc MulDiv WaitForSingleObject GetModuleHandleA ReadFile lstrlenA lstrcatA GetTickCount CreateFileA GetFileSize GetLastError lstrcmpiA CloseHandle GetProcAddress lstrcmpA WriteFile GlobalFree GlobalAlloc SleepEx SetFilePointer

user32

RedrawWindow GetMessageA wsprintfA DestroyWindow EnableWindow GetDlgItem UpdateWindow LoadIconA SetWindowTextA IsWindowVisible SystemParametersInfoA GetWindowLongA GetParent MessageBoxA SetWindowLongA DispatchMessageA KillTimer PostMessageA GetWindowTextA IsWindow SendDlgItemMessageA CreateDialogParamA TranslateMessage ShowWindow IsDialogMessageA GetWindowRect SetTimer SetDlgItemTextA SetWindowPos SendMessageA GetClientRect FindWindowExA

comctl32

ord17

wininet

InternetReadFile InternetErrorDlg HttpQueryInfoA InternetQueryOptionA InternetSetOptionA FtpCreateDirectoryA InternetConnectA InternetWriteFile InternetSetFilePointer FtpOpenFileA HttpEndRequestA HttpAddRequestHeadersA HttpSendRequestA InternetOpenA InternetGetLastResponseInfoA InternetCrackUrlA HttpOpenRequestA HttpSendRequestExA InternetCloseHandle

$PLUGINSDIR/InstallOptions.dll

IMPHASH 610235b90207a63ccf481f0d4375d329
SHA256 78012f560bb917218435f4b3ef2e3491bab15647e11ccb90bc117731181134c4
MD5 5d195f1ac9869c208f6c02a5bde6f9c1
SHA1 a8ec993a12708572ca8ca3d1fcbdc25230bdaf10
SHA512 1f6a2e909e3a7188f24758715cdc7c9d8c17450a67c37cc74487924b00d5402c125ff8ec27b42038e20b560016f086b05133bf2bd04e670a1c46fa38c1b20672
SSDEEP 192:C4n3T5aK+dHCMR1aQR9RuZl3WWmU7WYZsw1JpVGnrjYK72dwF7dBOne:jn3T5KdHCMRD/R1cOnrjY+BO
TLSH
T18D622A55738488F3DBE2003E785237079B995565B492AED2CA275FCA687B08D7EB2303
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10722

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetPrivateProfileIntA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileStringA SetCurrentDirectoryA GetModuleHandleA lstrcmpiA WritePrivateProfileStringA lstrcatA lstrcpynA GlobalFree lstrlenA lstrcpyA GlobalUnlock GlobalAlloc GlobalLock

user32

MapWindowPoints PtInRect CloseClipboard LoadCursorA GetDlgCtrlID OpenClipboard GetClientRect SetWindowRgn DrawFocusRect LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow DrawTextA SetCursor EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA CallWindowProcA PostMessageA MessageBoxA GetSysColor CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetWindowLongA EnableMenuItem GetSystemMenu GetClipboardData LoadIconA

gdi32

DeleteObject CombineRgn SetTextColor GetDIBits SelectObject CreateRectRgn GetObjectA CreateCompatibleDC

shell32

SHBrowseForFolderA SHGetPathFromIDListA ShellExecuteA SHGetDesktopFolder

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/ScrollLicense.dll

IMPHASH 241cd43f5540cd5c958a3c62d980c89c
SHA256 b9e71bc2c4f225c2d7d4661017eaf6978e919b784f388c35f33a94d6a78dafd3
MD5 5453c4dfcaa1cc08e06093d462911b4a
SHA1 1213f2adedcf2ae51c448d7dd188dae72d0a34e7
SHA512 c71f5acc09719c8c93f5866b2e1730afe8a5d9f5eeee5c482c107bb65869b19556e07d7e47bc41aa39e1d1bb697fe8bad116e1d15b1ea2cd8b92a4a8b8f5978d
SSDEEP 48:6ZSAYglzUuxvjHjwI9SW7NuQhcaKuQm1rzRMkFGzl+Dx3A7tbtp4EibZQ1dE58Eo:WXFjR9NhcaR1B7mgDx3A7hv4pYU
TLSH
T1C9B1DA3993F098F5D3B84BF26597B3A7112BA1302351504BDC375A186032A23DC6C763
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5677

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/StartMenu.dll

IMPHASH 17fb6a8708b9c0bb2d5d8687870eb415
SHA256 88cebbf8bad719d06709e9e29c39d1abe3325ae26f8d65c101e50df3afdd9057
MD5 c365c5ff6418efae5fe288bd0419fa5c
SHA1 62cecd954ef5645eeeeae44b05a29fc4a5fd5355
SHA512 06dfc1c25eccef1a1a43afa8cf965e08bef75a531c94a09dc9aaaa01d3eff8d91acd85bb9621fec8af48957d5b89bbb711326f99a45216517a4c6b35ed893564
SSDEEP 96:ygiqVPb3X8K8Kdr3gEq6nNdMk6Qiw290+q6LDtJ1tm3hhEl7y:ygiqVPgK8K9eIdE9B/tChg7
TLSH
T1BBF108BAF3C005B3CB8F86702817BF074B56E630535561A79A5341CA75D18A3ED38321
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

6399

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1
MD5 fbe295e5a1acfbd0a6271898f885fe6a
SHA1 d6d205922e61635472efb13c2bb92c9ac6cb96da
SHA512 2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06
SSDEEP 192:yPtkiQJr7V9r3Ftr87NfwXQ6whlgi62V7i77blbTc4DI:N7Vxr8IgLgi3sVc4
TLSH
T107324A5503604AF3E986843C086A3BBF6F796B2196F04E53DFA384C0EE6D5C96D78352
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10465

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
TLSH
T1D3D0C9C9501A802944208642A97A2FA263E03E210B1725FAF5724C87EB4CDE79C9D682
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/nsExec.dll

IMPHASH 46f8b6973f33717335c0f6d8087de67b
SHA256 e7b145abc7c519e6bd91dc06b7b83d1e73735ac1ac37d30a7889840a6eed38fc
MD5 50ba20cad29399e2db9fa75a1324bd1d
SHA1 3850634bb15a112623222972ef554c8d1eca16f4
SHA512 893e053fcb0a2d3742e2b13b869941a3a485b2bda3a92567f84190cb1be170b67d20cc71c6a2cb92f4202140c8afd9c40a358496947d709e0c4b68d43a368754
SSDEEP 96:17GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNT3e:5XhHR0aTQN4gRHdMqJVgNa
TLSH
T1EAD10B7675E22EB3C54ECE353C12762B57F8C8111B9401549B978BD23CC5EB3EA39282
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsis7z.dll

IMPHASH c8fc3b55c70f2f31f4c8639bf1efe362
SHA256 47ee083861b20a03a751593073dfb533a0aa447833bfb190a73732c7efb2a2b2
MD5 d3850d9ef1d81d2ee2e0a1583e3292f8
SHA1 36a88c987ac8fff6d97f5eea9af5c7421f0496ae
SHA512 3af395aeb470f4f5f26d2072811be2d15e90597ed40d5f1a6ab53e6b66f8a143785868db0476cbf129751cee2ae070ddad179848830e1215393c826101f9caac
SSDEEP 12288:PwuK6S/tEe0pY+IOLFZMMR2u6qpYvuhX:PwuK6S/toFF2+pY2
TLSH
T164949D21BA90C036C66F02306E2DF7AA20AD77F1593C965BB39C5B1F1FB04D16618B5B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

245761

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

FormatMessageA FormatMessageW GetFileInformationByHandle SetLastError DeviceIoControl GetModuleHandleA GetProcAddress HeapAlloc HeapFree GetProcessHeap GetModuleHandleW GetSystemTimeAsFileTime GetStdHandle WaitForMultipleObjects GetTickCount SetFileApisToOEM SetFileApisToANSI AreFileApisANSI GlobalAlloc GlobalFree lstrcpynA lstrcpyA MultiByteToWideChar WideCharToMultiByte FreeLibrary GetModuleFileNameW LoadLibraryExW GetCurrentDirectoryA GetCurrentDirectoryW CreateDirectoryA CreateDirectoryW DeleteFileA DeleteFileW RemoveDirectoryA RemoveDirectoryW SetFileAttributesA SetFileAttributesW SetFileTime LocalFree GetCurrentProcessId GetCurrentThreadId GetTempPathA MoveFileA MoveFileW FindClose FindFirstFileA FindFirstFileW GetFileAttributesA GetFileAttributesW SetEndOfFile GetCurrentProcess GetSystemInfo DecodePointer CreateFileA HeapSize WriteConsoleW SetFilePointerEx ReadConsoleW SetStdHandle GetStringTypeW GetCommandLineW GetCommandLineA FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage CreateSemaphoreA WaitForSingleObject CreateEventA ReleaseSemaphore ResetEvent SetEvent InitializeCriticalSection DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetVersionExA VirtualFree VirtualAlloc GetLastError CloseHandle WriteFile SetFilePointer ReadFile GetFileSize CreateFileW GetTempPathW GetConsoleMode GetConsoleCP FlushFileBuffers GetFileType HeapReAlloc LCMapStringW ExitProcess GetModuleHandleExW FreeLibraryAndExitThread UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter InitializeSListHead RtlUnwind EncodePointer RaiseException InterlockedFlushSList InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CreateThread ExitThread

user32

SendMessageA CharUpperW CharUpperA FindWindowExA GetDlgItem wsprintfA SetWindowTextA

advapi32

SystemFunction036 LookupPrivilegeValueA SetFileSecurityW AdjustTokenPrivileges OpenProcessToken

oleaut32

VariantCopy VariantClear SysAllocStringLen SysStringLen SysAllocString SysFreeString

uninstall.exe

IMPHASH 3abe302b6d9a1256e6a915429af4ffd2
SHA256 627c8046c7fae3664ce62719548b62849efec51cd356d0a0d955f4517563af90
MD5 75551dc9a5d7a49145e088a4ba71f18d
SHA1 d5902ff8dad0186d031942a55c80eea82884a8f4
SHA512 ac23bdec8fd119ef55ff2f1c646c7ba5ab2bfe67835c236b7fda3cbc3194ae815e2b796ada4453ddaf331bf7ac5f9b0d6674c762e5a25f3a2e7cf46ffe33b840
SSDEEP 3072:THyUVnSxLlPMct6mclwVgsMu8yuIDSeerPoYzAxK1/Y47x134fdX:TwlBcqVWUD5CQY0M974FX
TLSH
T12EF3F1137284D8ABC19B43B19ABBEAB1F2B1DCA1B0754B531312FF2F9CB31125A15197
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12758

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTempPathA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA Sleep GetTickCount GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GetWindowsDirectoryA SetCurrentDirectoryA GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject CompareFileTime SetFileAttributesA GetFileAttributesA GetShortPathNameA MoveFileA GetFullPathNameA SetFileTime SearchPathA CloseHandle lstrcmpiA CreateThread GlobalLock lstrcmpA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GlobalAlloc GlobalFree ExpandEnvironmentStringsA

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyExA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA RegEnumValueA RegDeleteKeyA RegDeleteValueA RegCloseKey RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/InstallOptions.dll

IMPHASH 610235b90207a63ccf481f0d4375d329
SHA256 78012f560bb917218435f4b3ef2e3491bab15647e11ccb90bc117731181134c4
MD5 5d195f1ac9869c208f6c02a5bde6f9c1
SHA1 a8ec993a12708572ca8ca3d1fcbdc25230bdaf10
SHA512 1f6a2e909e3a7188f24758715cdc7c9d8c17450a67c37cc74487924b00d5402c125ff8ec27b42038e20b560016f086b05133bf2bd04e670a1c46fa38c1b20672
SSDEEP 192:C4n3T5aK+dHCMR1aQR9RuZl3WWmU7WYZsw1JpVGnrjYK72dwF7dBOne:jn3T5KdHCMRD/R1cOnrjY+BO
TLSH
T18D622A55738488F3DBE2003E785237079B995565B492AED2CA275FCA687B08D7EB2303
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10722

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetPrivateProfileIntA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileStringA SetCurrentDirectoryA GetModuleHandleA lstrcmpiA WritePrivateProfileStringA lstrcatA lstrcpynA GlobalFree lstrlenA lstrcpyA GlobalUnlock GlobalAlloc GlobalLock

user32

MapWindowPoints PtInRect CloseClipboard LoadCursorA GetDlgCtrlID OpenClipboard GetClientRect SetWindowRgn DrawFocusRect LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow DrawTextA SetCursor EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA CallWindowProcA PostMessageA MessageBoxA GetSysColor CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetWindowLongA EnableMenuItem GetSystemMenu GetClipboardData LoadIconA

gdi32

DeleteObject CombineRgn SetTextColor GetDIBits SelectObject CreateRectRgn GetObjectA CreateCompatibleDC

shell32

SHBrowseForFolderA SHGetPathFromIDListA ShellExecuteA SHGetDesktopFolder

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1
MD5 fbe295e5a1acfbd0a6271898f885fe6a
SHA1 d6d205922e61635472efb13c2bb92c9ac6cb96da
SHA512 2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06
SSDEEP 192:yPtkiQJr7V9r3Ftr87NfwXQ6whlgi62V7i77blbTc4DI:N7Vxr8IgLgi3sVc4
TLSH
T107324A5503604AF3E986843C086A3BBF6F796B2196F04E53DFA384C0EE6D5C96D78352
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10465

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
TLSH
T1D3D0C9C9501A802944208642A97A2FA263E03E210B1725FAF5724C87EB4CDE79C9D682
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer

h2pc_setup_2.1.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/CRCCheck.dll

kernel32

generic

$PLUGINSDIR/INetC.dll

kernel32

user32

comctl32

wininet

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/ScrollLicense.dll

kernel32

user32

generic

$PLUGINSDIR/StartMenu.dll

kernel32

user32

gdi32

shell32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/ioSpecial.ini

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

$PLUGINSDIR/nsis7z.dll

kernel32

user32

advapi32

oleaut32

generic

uninstall.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32